Yamato, Estore and Nikkei Report Major Data Leaks in Japan

Major Japanese parcel delivery company Yamato Transport said on Friday about 5.31 million customer data records, including names and addresses, had been leaked due to unauthorized access to itspayment service system.

The service allows customers to pay for goods purchased online at convenience stores or other locations after receiving them. The data did not include credit card information or passwords.

The breach involved around 50,000 data records containing information such as the names and phone numbers of package recipients. In addition, about 4,100 data records containing the names of companies and stores that sell products online were also leaked.

Yamato Transport confirmed the unauthorized access on Sept 28 and suspended the service. It resumed operations on October 9. Estore Corp, which provides electronic commerce services for corporate clients, said Friday that a data breach discovered in August resulted in the exposure of records on about 23 million people, including online shop operators and their customers.

Leaked information includes names, addresses, telephone numbers and portions of credit card numbers, it said.

The affected server did not store full credit card numbers, and no financial damage has been reported, the company said.

Major daily publisher Nikkei Inc. said that about 1.83 million personal data records had been leaked due to unauthorized access to its cloudservice.

According to the company, the information includes names, telephone numbers, email addresses and addresses while 1.68 million of those records do not contain information that could identify individuals on its own.

The authentication credentials used to access the cloud service were stolen and the system was subject to unauthorized access from the early hours of October 7 through the morning.

No secondary damage resulting from the leaked information, nor any suspension of Nikkei’s system, have been confirmed, the company said.

Yokohama-based nutritional supplements maker Fancl Corp also confirmed that unauthorized access to its e-commerce website was detected and that around 390,000 personal data records were exposed.

About 440,000 personal data records of the company’s subsidiary Attenir Corp were also breached.

Unauthorized access occurred between Oct 3 and 10. The information leaked from both companies included names, addresses, email addresses, phone numbers, and dates of birth. It did not include payment information such as credit card details.